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Intellectual Property Rights 



IPRs essential or potentially essential to the present document may have been declared to ETSI. The information 
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found 
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in 
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web 
server ( http://ipr.etsi.org ). 

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee 
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web 
server) which are, or may be, or may become, essential to the present document. 



Foreword 

This Technical Specification (TS) has been produced by ETSI Technical Committee Lawful Interception (LI). 

The present document is part 7 of a multi-part deliverable. Full details of the entire series can be found in 
TS 102 232-1 [2]. 



Introduction 



The TS 102 232 [i. 1] series of standards aims to provide a common delivery interface for lawfully-intercepted material 
from a wide range of services. The aim of the present document is to increase the range of services to which the 
TS 102 232 [i.l] interface applies, by including services from 3GPP TS 33.108 [3] and ANSI/J-STD-025-B [4] within 
the TS 102 232 [i.l] delivery framework. 
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Scope 



The present document specifies an approach for the handover of the lawfully-intercepted information that is defined in 
the two standards: 3GPP TS 33.108 [3] and ANSI/J-STD-025-B [4]. The present document uses the handover 
techniques defined in TS 102 232-1 [2]. In this way, the present document allows additional services to be delivered 
through a common interface. 

1.1 UMTS/GPRS and EPS - 3GPP TS 33.1 08 

The scope of the present document includes the handover of lawfully-intercepted information from the following parts 
of 3GPPTS 33.108 [3]: 

• Intercept Related Information (IRI) from the mobile circuit-switched domain (3GPP TS 33.108, clause 5 [3]). 
Content of Communication (CC) from the mobile circuit-switched domain is not covered by the present 
document. 

• IRI and CC from the mobile packet- switched domain (3GPP TS 33. 108, clause 6 [3]). 

• IRI and CC from the multi-media domain (3GPP TS 33.108, clause 7 [3]). 

• IRI and CC from the EPS domain (3GPP TS 33.108, clause 10 [3]). 

The present document does not override or supersede any specifications or requirements in 3GPP TS 33.108 [3]. 

1 .2 CDMA2000 - ANSI/J-STD-025-B 

The scope of the present document includes the handover of lawfully-intercepted information from the following parts 
of ANSI/J-STD-025-B [4]: 

• Call identifying information from the mobile circuit-switched domain (J-STD-025-B [4], clause 5.4). 
Call Content (CC) from the mobile circuit-switched domain is not covered by the present document. 

• Communication identifying information (CII) and CC from the mobile packet-switched domain 
(J-STD-025-B [4], clause 5.5). 

The present document does not override or supersede any specifications or requirements in ANSI/J-STD-025-B [4]. 



2 References 

References are either specific (identified by date of publication and/or edition number or version number) or 
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the 
referenced document (including any amendments) applies. 

Referenced documents which are not found to be publicly available in the expected location might be found at 
http://docbox.etsi.org/Reference . 

NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee 
their long term validity. 

2.1 Normative references 

The following referenced documents are necessary for the application of the present document. 

[1] ETSI TS 101 671: "Lawful Interception (LI); Handover interface for the lawful interception of 

telecommunications traffic". 
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NOTE: Periodically TS 101 671 is published as ES 201 671. A reference to the latest version of the TS as above 
reflects the latest stable content from ETSI/TC LI. 

[2] ETSI TS 102 232-1: "Lawful Interception (LI); Handover Interface and Service-Specific Details 

(SSD) for IP delivery; Part 1: Handover specification for IP delivery". 

[3] ETSI TS 133 108: "Universal Mobile Telecommunications System (UMTS); LTE; 3G security; 

Handover interface for Lawful Interception (LI) (3GPP TS 33.108)". 

[4] TIA/ATIS ANSI/J-STD-025-B (August 2006): "Lawful Authorized Electronic Surveillance," as 

amended by ANSI/J-STD-025-B-l (September 2006): "Lawfully Authorized Electronic 
Surveillance (LAES) Addendum 1 - Addition of Mobile Equipment IDentifier (MEID)" and by 
ANSI/J-STD-025-B-2 (April 2007): "Lawfully Authorized Electronic Surveillance (LAES) - 
Addendum 2 - Support for Carrier Identity". 

[5] PubHc Law 103-414: "Communications Assistance for Law Enforcement Act (CALEA)", US 

103"' Congress, 108 STAT. 4279 (October 25, 1994). 

2.2 Informative references 

The following referenced documents are not necessary for the application of the present document but they assist the 
user with regard to a particular subject area. 

[i.l] ETSI TS 102 232 (all parts): "Lawful Interception (LI); Handover Interface and Service-Specific 

Details (SSD) for IP delivery". 



Definitions and abbreviations 



3.1 Definitions 

For the purposes of the present document, the terms and definitions given in TS 102 232-1 [2] and TS 101 671 [1] 
apply. 

call-identifying information: ANSI/J-STD-025-B [4] states that this term is defined in CALEA Section 102 (2) [5] to 
be "dialling or signalling information that identifies the origin, direction, destination, or termination of each 
communication generated or received by a subscriber by means of any equipment, facility, or service of a TSP." 

NOTE: This term is always used in expanded format. 

3.2 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 

ASN. 1 Abstract Syntax Notation One 

ATIS Alliance for Telecommunications Industry Solutions 

CC Call Content (ANSI) 

CC Content of Communication (ETSI and 3GPP) 

CDMA Code Division Multiple Access 

CII Communication-Identifying Information 

CIN Communications Identity Number 

CSP Communications Service Provider 

NOTE: CSP covers all Access Providers, Network Operators and Service Providers. 

EPC Evolved Packet Core 

EPS Evolved Packet System 

GPRS General Packet Radio Service 

IP Internet Protocol 

IRI Intercept Related Information 
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LAES 

LEMF 

LI 

LTE 

MF 

PDU 

PTSC 

PS 

TIA 

uLIC 

UMTS 



Lawfully Authorized Electronic Surveillance (Committee of ATIS) 

Law Enforcement Monitoring Facility 

Lawful Interception 

Long Term Evolution (of UMTS) 

Mediation Function (at CSP) 

Protocol Data Unit 

Packet Technologies and Systems Committee (Committee of ATIS) 

Packet Switched 

Telecommunications Industry Association 

UMTS LI Correlation 

Universal Mobile Telecommunication System 



4 General 

4.1 Approach 

The present document forms part 7 of the TS 102 232 family of standards, in that it is a service-specific component of 
the TS 102 232-1 [2] framework. 

3GPP TS 33.108 [3] and ANSI/J-STD-025-B [4] define the interception behaviour that leads to IRI, 
Communication-Identifying Information (CII) or call-identifying information events on the handover interface, for both 
the packet data domain and circuit switched domain. 



4.2 



Reference model 




Mediation 
Function (MF) 






Law Enforcement 

Monitoring 
Facility (LEMF) 








Handover 
interface 





Figure 1 : Reference model 



GPRS/UMTS Headers, data exchange and networks 



5.1 Approach 



TS 102 232-1 [2] describes a technique for data exchange, and specifies the headers that shall be associated with the 
results of interception. The present document follows TS 102 232-1 [2] regarding headers, data exchange and networks 
demonstrates how the header fields in TS 102 232-1 [2] can be populated in a direct and straightforward manner using 
the interception information available in 3GPP TS 33.108 [3]. 

5.2 Structures 

IRI events from 3GPP TS 33.108 [3], for both circuit and packet switched services, are sent using the uMTSIRI element 
of IRIContents. 

CC from packet switched services are sent using the uMTSCC element CCContents, which is an OCTET STRING. 
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6 GPRS/UMTS Intercept Related Information (IRI) and 
Content of Communication (CC) 

6.1 Definition of IRI events and 00 

IRI events are defined as per 3GPP TS 33.108 [3]. 

6.2 IRI format 

IRI events are defined as per 3GPP TS 33.108 [3] for both circuit and packet switched services. They are sent using the 
uMTSIRI element of IRIContents. 

Fields which are dupHcated in the 3GPP TS 33.108 [3] and TS 102 232-1 [2] structures should be populated 
consistently in both structures. Clause A. 1 gives guidance on mapping between 3GPP TS 33.108 [3] elements and 
TS 102 232-1 [2] elements for IRI. 

6.3 00 format 

CC from packet switched services are sent using the uMTSCC element CCContents, which is an OCTET STRING. The 
OCTET STRING will be as defined in the payload element of the CC-PDU structure in 3GPP TS 33.108 [3], 
clause B.4. 

The information in the uLIC -header element of CC-PDU will be used to populate the header information in the 
LI-PS-PDU structure of TS 102 232-1 [2]. Clause A.l gives guidance on the mapping between these elements. 

7 CDMA2000 Headers, data exchange and networks 



7.1 Approach 



TS 102 232-1 [2] describes a technique for data exchange, and specifies the headers that shall be associated with the 
results of interception. The present document follows TS 102 232-1 [2] regarding headers, data exchange and networks. 
It demonstrates how the ANSI/J-STD-025-B [4] data is to be carried in the corresponding CC and IRI payload fields of 
TS 102 232-1 [2] and how the header fields in TS 102 232-1 [2] must be populated using the corresponding information 
from the ANSI/J-STD-025-B [4] data structures. 

Permission has been given to ETSI/TC LI by TIA and ATIS to make use of Annex I of the TIA/ATIS joint standard 
J-STD-025B [4], which contains the ASN.l code for that standard, in the present document. That Annex 1 contains the 
code as prepared in text form by the PTSC LAES committee of ATIS, and subsequently amended by the changes 
defined by J-STD-025-B-1 [4] and by J-STD-025-B-2 [4]. 

7.2 Structures 

Call-identifying information in J-STD-025-B [4], clauses 6.3 and 6.4 for circuit switched services is sent by carrying 
the imported LAESProtocol element of Laesp-j-std-025-b as lAESProtocol in IRIContents. This contains the 
LAESMessage parameter that defines the LAES messages. 

CII events from J-STD-025-B [4], clause 6.5 for packet switched services are sent by carrying the imported 
CDMA2000LAESMessage element of CDMA2000CIIModule as cDMA2000LAESMessage in IRIContents. 

CC for J-STD-025-B, clause 6.6.2.1 [4] packet switched services is sent by carrying the imported CCIPPacketHeader 
element of CDMA2000CCModule in CCContents. 
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8 CDMA2000 Communication-Identifying Information 

(CM), Call-Identifying Information and Call Content 
(CC) 

The TS 102 232-1 [2] fields in PSHeader must be populated using the corresponding fields from the 
ANS1/J-STD-025-B [4] data structures as shown in table 1: 

Table 1 : Populating the PSHeader 



TS 102 232-1 [2] element 


Source from 
ANSI/J-STD-025-B 


Comments 


pSHeader.lawfullnterceptionldentifier 


case Identity 


Same value 


pSHeader. communication Identifier.networkldentifier.networkElementldentifier 


iapSystemldentity 


Same value 


pSHeader.timeStamp 


timeStamp (note) 


Same value 


NOTE: The source timestamp is in generalized time format. 

The optional use of MicroSecondTimeStamp does not apply. 



EPS Headers, data exchange and networks 



9.1 Approach 



TS 102 232-1 [2] describes a technique for data exchange, and specifies the headers that shall be associated with the 
results of interception. The present document follows TS 102 232-1 [2] regarding headers, data exchange and networks 
demonstrates how the header fields in TS 102 232-1 [2] can be populated in a direct and straightforward manner using 
the interception information available in 3GPP TS 33.108 [3]. 

9.2 Structures 

IRI events from 3GPP TS 33.108 [3], for EPS services, are sent using the ePSlRl element of IRlContents. 
CC from EPS services is sent using the ePSCC element of CCContents, which is an OCTET STRING. 



10 EPS Intercept Related Information (IRI) and Content 
of Communication (CC) 

10.1 Definition of IRI events and 00 

IRI events are defined as per 3GPP TS 33.108 [3]. 

10.2 IRI format 

IRI events for EPS services are defined as per clause 10 of 3GPP TS 33. 108 [3]. They are sent using the ePSIRI element 
of IRlContents. 

Fields which are dupHcated in the 3GPP TS 33.108 [3] and TS 102 232-1 [2] structures should be populated 
consistently in both structures. Clause A.l gives guidance on mapping between 3GPP TS 33.108 [3] elements and 
TS 102 232-1 [2] elements for IRI. 
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10.3 CC format 



CC from EPS is sent using the ePSCC element of CCContents, which is an OCTET STRING. The OCTET STRING 
will be as defined in the payload element of the CC-PDU structure in 3GPP TS 33.108 [3], clause B.IO. 

The information in the uLIC -header element of CC-PDU will be used to populate the header information in the 
LI-PS-PDU structure of TS 102 232-1 [2]. Clause A. 1 gives guidance on the mapping between these elements. 
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Annex A (normative): 
ASN.1 forlRlandCC 

A.1 Note on integrating ASN.1 structures 
A.1 .1 Header field mappings 

Table A.1 shows how elements of the TS 102 232-1 [2] PSHeader structure should be populated from information in 
the 3GPP TS 33.108 [3] IRI-Parameters structure. 

Table A.1 : 3GPP TS 33.108 [3] to TS 102 232-1 [2] PSHeader mapping 



TS 102 232-1 [2] PSHeader element 


Source from 3GPP TS 33.108 [3] 


lawfullnterceptionldentifier 


Copied directly from IRI-Parameters. lawfullnterceptionldentifier 


authorizationCountryCode 


Supplied directly by the MF 


communicationldentifier 


See below for individual elements 


networkldentifier 


See below for individual elements 


operatorldentifier 


Copied directly from IRI-Parameters. networkldentifier.operatorldentifier 


eTSI671NEID 


Copied directly from IRI-Parameters. networkldentifier. 
Network-Element-ldentifier 


communicationldentityNumber 


See clause A.1. 2 


deliveryCountryCode 


Supplied directly by the MF 


sequenceNumber 


Supplied directly by the MF 


timeStamp 


Copied from IRI-Parameters.timeStamp. 

This requires a conversion from HI20perations. TimeStamp to 

GeneralizedTime 



Table A. 2 shows how elements of the TS 102 232-1 [2] IRIPayload structure should be populated from information in 
the 3GPP TS 33.108 [3] structures. 

Table A.2: 3GPP TS 33.108 [3] to TS 102 232-1 [2] IRIPayload mapping 



TS 102 232-1 [2] IRIPayload element 


Source from 3GPP TS 33.108 [3] 


IRIType 


Inferred from UmtslRIContent or EpslRIContent 


timeStamp 


Copied from IRI-Parameters.timeStamp (assuming no aggregation of PDUs) 
This requires a conversion from HI20perations. TimeStamp to 
GeneralizedTime 


IRIContents 


See below for individual elements 


uMTSIRI 


See below for individual elements 


IRI-Parameters 


Copied directly from IRI-Parameters, if handing over packet domain IRI 


iRI-CS-Parameters 


Copied directly from IRI-Parameters, if handing over circuit switched IRI 


ePSIRI 


See below for individual elements 


iRI-EPS-Parameters 


Copied directly from IRI-Parameters, if handing over EPS IRI 
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Table A. 3 shows how elements of the TS 102 232-1 [2] PSHeader structure should be populated from information in 
the 3GPP TS 33.108 [3] CC-PDU structure. 

Table A.3: 3GPP TS 33.108 [3] to TS 102 232-1 [2] PSHeader mapping 



TS 102 232-1 [2] PSHeader element 


Source from 3GPP TS 33.108 [3] 


lawful Interceptionldentifier 


Copied from CC-PDU. uLIC-header.lllD 


authorizationCountryCode 


Supplied directly by the MF 


communicationldentifier 


See below for individual elements 


networkldentifier 


See below for individual elements 


operatorldentifier 


Supplied directly by the MF (see 3GPP TS 33.1 08, clause 5.2.4 [3]) 


eTSI671NEID 


Supplied directly by the MF (see 3GPP TS 33.1 08, clause 5.2.4 [3]) 


communicationldentityNumber 


See clause A.I. 2 


deliveryCountryCode 


Supplied directly by the MF 


sequenceNumber 


Supplied directly by the MF 


timeStamp 


Copied from CC-PDU. uLIC-header.timeStamp 

This requires a conversion from HI20perations. TimeStamp to 

GeneralizedTime 



Table A.4 shows how elements of the TS 102 232-1 [2] CCPayload structure should be populated from information in 
the 3GPP TS 33.108 [3] structures. 

Table A.4: 3GPP TS 33.108 [3] to TS 102 232-1 [2] CCPayload mapping 



TS 102 232-1 CCPayload element 


Source from 3GPP TS 33.108 [3] 


payloadDirection 


Copied from CC-PDU. uLIC-header.t-PDU-direction 

This requires a trivial translation between TPDU-direction and 

PayloadDirection enumerated types 


timeStamp 


Copied from CC-PDU. uLIC-header.timeStamp 

This requires a conversion from HI20perations.TimeStamp to 

GeneralizedTime 


ccContents 


See below for individual elements 


uMTSCC 


Bytes copied from CC-PDU. payload 


ePSCC 


Bytes copied from CC-PDU. payload 



A.1.2 CIN allocation 



CIN allocation follows TS 102 232-1, clause 5.2.4 [2]. The CIN extension field may be used, if required, using the 
CorrelationValues field as described in 3GPP TS 33.108 [3]. 
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Annex B (informative): 
Change request history 
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TC LI approval 
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February 201 1 


2.2.1 


Included Change Request: 
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This CR was approved by TC Ll#26 (15-17 February 201 1 , Sophia Antipolis): 

Version 2.2.1 prepared by Peter van der Arend (Vodafone) (Chairman TC LI) 
Rapporteur of this specification is Mark Shepherd (NTAC) 


May 201 2 


3.1.1 


Included Change Request: 

TS 102 232-07CR002 (Cat B) Introduce changes to accommodate EPS 

This CR was approved by TC Ll#30 (14-16 May 2012, Amsterdam): 

Version 3.1 .1 prepared by Peter van der Arend (Vodafone) (Chairman TC LI) 
Rapporteur of this specification is Mark Shepherd (NTAC) 
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